public consultation on the contractual public-private partnership on cybersecurity … ·...
TRANSCRIPT
1
Case Id: 43face40-125c-4cd9-89a3-40e4024a39bdDate: 11/03/2016 02:44:56
Public consultation on the contractual public-privatepartnership on cybersecurity and possibleaccompanying measures
Fields marked with * are mandatory.
Public consultation on the contractual public-private partnership oncybersecurity and possible accompanying measures
Purpose
On 6 May 2015, the European Commission adopted the , whichDigital Single Market (DSM) Strategyprovides for establishing a contractual Public-Private Partnership (cPPP) on cybersecurity in the areaof technologies and solutions for online network security in the first half of 2016.
The Commission is now consulting stakeholders on the areas of work of the future cybersecuritycontractual public-private partnership. The Commission is also calling for contributions on potentialadditional policy measures that could stimulate the European cybersecurity industry.
With respect to cybersecurity standardisation, this consultation complements the overall publicconsultation on the development of the Priority ICT Standards Plan: "Standards in the Digital Single
in which cybersecurity is one of the areas covered.Market: setting priorities and ensuring delivery",
The Commission will use the feedback from the consultation to establish the cPPP in the first half of2016.
Background
Current EU policies, such as the and theCybersecurity Strategy for the European Union Commission's , aim to ensure thatproposal for a Directive on Network and Information Securitynetwork and information systems, including critical infrastructures, are properly protected and secure.
A lot of work has already been done with industrial stakeholders within the NIS Platform. In particularthe Working Group 3 has finalised a for cybersecurity whichNIS Platform Strategic Research Agendaserves as the basis for the questions on prioritising research and innovation topics in thisconsultation.
The establishment of a contractual Public-Private Partnership addressing digital security would be afurther step towards cybersecurity industrial policy. The Commission is now considering whatadditional industrial measures may be needed to complement the cPPP.
The cPPP will be a contractual arrangement between the Commission and an industrial grouping,
2
The cPPP will be a contractual arrangement between the Commission and an industrial grouping,both of which are committed to supporting, in the EU's Horizon 2020 programme, research andinnovation activities of strategic importance to the Union’s competitiveness in the field ofcybersecurity.
A contractual PPP bringing together industrial and public resources would focus on innovationfollowing a jointly-agreed strategic research and innovation roadmap. It would make the best possibleuse of available funds through better coordination with member states and a narrower focus on asmall number of technical priorities. It should leverage funding from Horizon 2020 to deliver bothtechnological innovation and societal benefits for users of technologies (citizens, SMEs, criticalinfrastructure), as well as provide visibility to European R&I excellence in cyber security and digitalprivacy. Furthermore cybersecurity is explicitly identified in the DSM strategy as a priority area inwhich there is a need to define missing technological standards.
Duration
Opens on 18 December 2015 – closes on 11 March 2016 (12 weeks)
Comments received after the closing date will not be considered.
Who should respond
Businesses (providers and users of cybersecurity products and services);Industrial associationsCivil society organisationsPublic authoritiesResearch and academiaCitizens
Transparency
Please state whether you are responding as an individual or representing the views of anorganisation. We ask responding organisations to register in the . We publishTransparency Registerthe submissions of non-registered organisations separately from those of registered ones as the inputof individuals.
How to respond
Respond online
You may pause any time and continue later. You can download a copy of your contribution onceyou've sent it.
Only responses received through the online questionnaire will be taken into account and included inthe report summarising the responses, exception being made for the visually impaired.
Accessibility for the visually impaired
We shall accept questionnaires by email or post in paper format from the visually impaired and theirrepresentative organisations: download the questionnaire
Email us and attach your reply as Word, PDF or ODF document
Or
Write to
3
Write to
European Commission
DG Communication networks, content & technology
Unit H4 – Trust & Security25 Avenue BeaulieuBrussels 1049 - Belgium
Replies & feedback
We shall publish an analysis of the results of the consultation on this page 1 month after theconsultation closes.
Protection of personal data
For transparency purposes, all the responses to the present consultation will be made public.
Please read the Specific privacy statement below on how we deal with your personal data andcontribution.
Protection of personal data
Specific privacy statement
References
Current EU policies in the field:
Cybersecurity Strategy for the EUEC proposal for a Directive on Network and Information Security
Work on online privacyWork with stakeholders in the Network and Information Security Platform
Contact
General information on respondents
Please note that fields marked with * are mandatory.
*Do you wish your contribution to be published?
Please indicate clearly if you do not wish your contribution to be published
YesNo
Submissions that are sent anonymously will neither be published nor taken into account.
*The Commission may contact you in case a clarification regarding your submission is needed
*
*
4
*The Commission may contact you in case a clarification regarding your submission is neededdepending on your reply to the following question.
Do you wish to be contacted?
YesNo
* I'm responding as:
An individual in my personal capacityThe representative of an organisation/company/institution
Is your organisation registered in the Transparency Register of the European Commission and theEuropean Parliament?
YesNo
Please give your organisation's registration number in the Transparency Register. Weencourage you to register in the Transparency Register before completing this questionnaire. If yourorganisation/institution responds without being registered, the Commission will consider its input asthat of an individual and publish it under that heading.
Globa6214521205
Please tick the box that applies to your organisation and sector.
National administrationNational regulatorRegional authorityNon-governmental organisationSmall or medium-sized businessMicro-businessEuropean-level representative platform or associationNational representative associationResearch body/academiaPressOther
If you chose "Other" please specify
Swiss not-for-profit organization
My institution/organisation/business operates in:
All EU member states
Austria
*
*
5
AustriaBelgiumBulgariaCzech RepublicCroatiaCyprusDenmarkEstoniaFranceFinlandGermanyGreeceHungaryItalyIrelandLatviaLithuaniaLuxembourgMaltaNetherlandsPolandPortugalRomaniaSpainSloveniaSlovakiaSwedenUnited KingdomOther
*Please enter the name of your institution/organisation/business.
Global Legal Entity Identifier Foundation (GLEIF)
*Please enter your name
Stephan Wolf
*Please enter the address of your institution/organisation/business
Baumleingasse 22,4015 Basel, Switzerland/Bleishstrasse 59, Frankfurt am Main,
Germany
*What is your place of main establishment or the place of main establishment of the entity you
*
*
*
*
6
What is your place of main establishment or the place of main establishment of the entity yourepresent (headquarters)?
Germany
Consultation
Note:
Depending on the question please make either one choice or multiple choices in responses tospecific questionsPlease note that a character limit has been set for most open questions
I. Identification of your priorities in cybersecurity
*1. Which part of the value chain of cybersecurity services and products do you represent?
ResearcherCustomer/UserSupplier of cybersecurity products and/or servicesPublic authority/government agency responsible for cybersecurity/research
If you answered "customer/user", which specifically?
Certification/audit or standardisation agentIndividual userSME userPrivate enterprisePublic userCivil SocietyOther
If you answered "other", please specify
400 character(s) maximum
Public/Private Partnership
2. Which of the following describes the cybersecurity activities of yourinstitution/organisation/business? (multiple answers possible)
2.1. Dedicated Cybersecurity -> Cybersecurity products/servicesIdentity and access managementData securityApplications security
Infrastructure (network) security
*
7
Infrastructure (network) securityHardware (device) securityIT security audit, planning and advisory servicesIT security trainingOther
If you answered "other", please specify
400 character(s) maximum
2.2. Applied Cybersecurity -> Application areas with demand in cybersecurity products/servicesCritical infrastructures in generalEnergyTransportHealthFinance and BankingPublic AdministrationSmart CitiesDigital Service ProvidersProtection of individual usersProtection of SMEsOther
Please specify:
400 character(s) maximum
2.3. Applied Cybersecurity -> Specific IT technology areas with cybersecurity as a functionalrequirement
Internet of ThingsEmbedded SystemsCloud Computing5GBig DataSmartphonesSoftware EngineeringHardware EngineeringOther
Please specify:
400 character(s) maximum
8
II. Assessment of cybersecurity risks and threats
1. Risk identification
*1.1. What are the most pressing cybersecurity challenges for users (individuals, business, publicsector)?
between 1 and 3 choicesLoss of know-how and confidential business information (trade secrets) – industrial and
economic espionage, and other types of confidential informationIndustrial or economic sabotage (examples: disrupting or slowing down network and computer
functioning)Extraction and use of identity and payment data to commit fraudIntrusion in privacyOther
*Please specify:
1200 character(s) maximum
The need to protect the correct identity information so that users can rely on
knowing their counterparties.
*1.2. Which sectors/areas are the most at risk? (please choose top 3-5)
between 3 and 5 choicesCritical infrastructures in generalEnergyTransportHealthFinance and BankingPublic AdministrationSmart CitiesDigital Service ProvidersProtection of individual usersProtection of SMEsOtherI don't know
Please specify:
400 character(s) maximum
2. Preparedness
*
*
*
9
*2.1. Are the necessary products/services available on the European market to ensure security of thewhole value chain
YesNoI don't know
2.2. If relevant, where do the cybersecurity products/services you purchase come from?
National/domestic supplierEuropean, non-domestic supplierUSIsraelRussiaChinaJapanSouth KoreaOther
2.3. If relevant, what are the reasons behind your decision to choose non-European ICT securityproducts/services over European ones?
Price competitivenessNon-European products/services are more innovativeTrustworthinessInteroperability of products/solutionsLack of European supplyPlace of origin is irrelevantOther
2.4. If relevant, what are the reasons for missing supplies of products/services in cybersecurity?Lack of capital for new products/servicesLack of sufficient (national/European/global) demand to justify investmentLack of economics of scale for the envisaged (national/European/global) marketsMarket barriersOtherI don't know
3. Impact
*3.1. In which of the following areas would you expect the worst potential socio-economic damage?(please choose your top 1-5 answers)
between 1 and 5 choicesCritical infrastructuresEnergyTransportHealth
*
*
10
HealthFinance and BankingPublic AdministrationSmart CitiesDigital Service ProvidersProtection of individual usersProtection of enterprises (large companies and/or SMEs)OtherI don't know
Please specify/explain
1200 character(s) maximum
Unique entity identification based on the Global LEI system is a prerequisite
to protect the above-mentioned areas from damage based on incorrect entity
information.
4. Cybersecurity challenges by 2020
4.1. What will be the 3 main cybersecurity challenges by 2020? (Please explain)
1200 character(s) maximum
Economic sabotage, Identity theft, System disruption
III. Cybersecurity Market Conditions
1. To what extent are markets in cybersecurity products/services competitive in Europe? Pleaseprovide your assessment of the overall situation in Europe and your views on the particular sectors ofyour expertise1200 character(s) maximum
No opinion.
2. If you are a company headquartered in the European Union, how would you assess the situation ofinnovative SMEs and start-ups working in the field of cybersecurity and privacy in the EuropeanUnion?a. Please assess the ease of access to markets in EU countries other than your ownb. Please assess the opportunities for operating in the European Single Market
1200 character(s) maximum
3. If you are a company headquartered outside the European Union, pleasea. assess the ease of accessing the EU market
b. assess the opportunities for operating in the European Single Market
11
b. assess the opportunities for operating in the European Single Marketc. explain how much you have invested or intend to invest in Europe over the past/next five yearsrespectively?
1200 character(s) maximum
GLEIF is a global operating Swiss foundation with excellent access to the
European market via its German branch office.
4. How does European competitiveness compare to other countries/regions? In particular what are thestrengths and weaknesses of European cybersecurity solution providers (self-assessment if you are asupplier)?
1200 character(s) maximum
No opinion.
5. Which level of ambition do you think the EU should set itself for cybersecurity market development?(Please mark for each category.)
Retain globallead
Strive for globalleadership
Make EU morecompetitive
*Identity and accessmanagement
*Data security
*Applications security
*Infrastructure (network)security
*Hardware (device) security
*IT security audit, planningand advisory services
*IT security management andoperation services
*IT security training
6. How does legislation (currently in force or soon to be adopted) influence the European cybersecuritymarket(s) or how is it likely to do so?
1200 character(s) maximum
Legislation being enacted in the EU relying on usage and accuracy of Legal
Entity Identification will demand that this information remain correct and
secure.
*
*
*
*
*
*
*
*
12
7. How does public procurement impact the European cybersecurity market? :
It is a driver behind cybersecurity market development and an opportunity for companies toincrease market share,It is a barrier to market accessI don't know
Please explain
1200 character(s) maximum
Examples in other parts of the world indicate that public demand can stipulate
innovation and growth in IT/security.
8. Do you feel you have sufficient access to financial resources to finance cybersecurityprojects/initiatives?
YesNo
9. What are the types of financial resources you currently use?
Bank loansEquity fundsVenture fundsEIB/EIF supportSovereign welfare fundsCrowd fundingEU fundsOther
If "other", please specify:
600 character(s) maximum
GLEIF is funded by fees from LEI issuance. The Global LEI system is under
oversight by 70 international financial regulators. Twenty international
organizations have observer status in the Regulatory Oversight Committee. See
more on https://www.gleif.org.en/about
10. Do you feel that the European ICT security and supply industry has enough skilled humanresources at its disposal?
YesNoI don't know
Please explain
13
1200 character(s) maximum
The industry is not acting fast enough on skill management. Universities do
not focus enough on industry demands. Certification is falling behind. Many
experts come therefore from abroad.
11. Have you ever experienced any barriers related to market access and export within the EU and/orbeyond EU countries?
YesNo
12. Are you aware of any start-up policy measures for cybersecurity industry in your country/theEuropean Union?
YesNo
IV. Need for public intervention and support for a functioning market in cybersecurity products/services in Europe
1. In your opinion, in what areas does the European market for cybersecurity products and servicesfunction well and where would public intervention be unnecessary or even detrimental? (Pleasespecify)
1200 character(s) maximum
Data privacy protection
2. What problems need to be addressed at European level to achieve a functioning Digital SingleMarket in cybersecurity products/services? (Please specify)
1200 character(s) maximum
Identity management through the LEI can be a positive contributor to the
success of the Digital Single Market. The LEI would bridge the digital
economy with real world identity management. The LEI already is mandated by
European regulators in the area of Finance. An extension to capture digital
identity would be advisable and beneficial for European enterprises and
consumers.
3. How do you assess public support and intervention at national level with regard to the cybersecuritymarket? How useful / necessary / adequate is it? (Please specify)
1200 character(s) maximum
More regulation on a European scale is needed to overcome national barriers
and standards. Identity management being most important in this space.
14
4. Please provide examples of successful support through public policies (at national or internationallevel).
1200 character(s) maximum
Counterparty identification in Europe through MiFID/MiFIR regulation in the
Finance area. Important for risk management and protection on a global scale.
V. Specific Industrial Measures
The first question in this section complements the overall public consultation on the Priority ICTStandards Plan with respect to the specific characteristics of cybersecurity standardisation. Weunderstand by standardisation in this context the production of technical specifications, standards orarchitectures where there is a need/gap, but also any other type of standardisation action such aslandscape analysis, gap finding, roadmaps or ecosystem building.
1. How would you evaluate the current role of standardisation in the domain of cybersecurity?
*1.1. Have you applied or are you currently working with specific technical specifications, standards orarchitectures relevant to cybersecurity?
1200 character(s) maximum
No, GLEIF is not currently working on these as GLEIF relies on its suppliers
in the area of cybersecurity.
1.2. In what areas is there a need/gap in this respect?
1200 character(s) maximum
In the near term, GLEIF is going to engage with standards organizations and
technology providers to embed the LEI in digital identity management. For
instance, the LEI could become of source of validation for digital
certificates.
*1.3. Would you consider standardisation as a mean to support innovation and the digital singlemarket in cybersecurity?
YesNoI don't know
*Please explain your view
1200 character(s) maximum
Standards are a prerequisite for any international technology adoption.
Standards such as ISO 17442 are the foundation for public goods where the
industry failed to deliver scalable solutions with no barrier to access.
*
*
*
15
*1.4. Should standardisation in cybersecurity be addressed generically or should it focus on specificsectors (e.g. transport, energy, finance) and areas of application (e.g. connected vehicles,smart-grids, electronic payments)? (Please specify your choice)
1200 character(s) maximum
There should be foundational standards and each sector should review and apply
these standards as necessary for the particular sector.
*1.5. What areas should future cybersecurity standardisation efforts focus on? (Please specify).
1200 character(s) maximum
Finance, Internet trade, identity threats
2. Assessment of existing certification schemes in the field of cybersecurity
*2.1. Are you active in public or private certification bodies?
YesNo
2.2. Which existing ICT security certification schemes would you consider successful and whatlearnings should be taken from them for future cybersecurity certification activities?
1200 character(s) maximum
Not applicable
*2.3. Do the current ICT security certification schemes adequately support the needs of Europeanindustry (either supplying or buying cybersecurity solutions)?
YesNoI don't know
Please explain
1200 character(s) maximum
Not sufficient in the area of identity management.
*2.4. How relevant are certification schemes to the digital single market in cybersecurity products andservices?
1200 character(s) maximum
Very important. See Extended Validation Certificates as an example.
*2.5. What areas should future certification efforts focus on?
*
*
*
*
*
16
*2.5. What areas should future certification efforts focus on?
1200 character(s) maximum
Identity management
*2.6. Are certification schemes mutually recognised widely across European Union's Member States?
YesNoI don't know
*2.7. Is it easy to demonstrate equivalence between standards, certification schemes, and labels?
YesNoI don't know
Please explain
1200 character(s) maximum
They rely on each other; they are not equivalent.
*3. Are you aware of any existing labelling schemes for cybersecurity products and services in Europeor in the rest of the world?
YesNo
*3.3. How would you assess the need to develop new or expand existing labels in Europe?
1200 character(s) maximum
No opinion
*3.4. Which market(s) would most benefit from cybersecurity labels?Consumer marketProfessional market (SMEs)Professional market (large companies)I don't know
3.5. What criteria / specific requirements are necessary to make such labels trustworthy?
1200 character(s) maximum
No opinion
*4. What form of access to finance would be most useful for European cybersecurity industry playersto encourage business growth?
*
*
*
*
*
*
*
17
between 1 and 5 choicesBank loansEquity fundsVenture fundsEIB/EIF supportSovereign welfare fundsCrowdfundingEU funds, please specifyOther
*Please explain
1200 character(s) maximum
All of the above. Focus should be on private equity and venture capital.
5. What specific start-up policy measures do you consider useful for the cybersecurity industry in theEuropean Union?
1200 character(s) maximum
No opinion
6. What do you think would be the right measures to support the EU market access and exportstrategy for cybersecurity products and services?
1200 character(s) maximum
No opinion
7. How would you assess the role of national/regional cybersecurity clusters (or national/regionalcybersecurity centres of excellence) and their effectiveness in fostering industrial policies in the field ofcybersecurity?
1200 character(s) maximum
No opinion
8. Are there any other specific policy instruments you think would be useful to support thedevelopment of the European cybersecurity industry?
1200 character(s) maximum
Mandating the LEI as a standard for identity management above and beyond the
Finance sector.
VI. The role of research and innovation in cybersecurity
1. Have you participated in previous R&I efforts through European (FP7, CIP) programmes?
*
18
1. Have you participated in previous R&I efforts through European (FP7, CIP) programmes?YesNo
19
2. On which levels would you focus public support for research & innovation measures (please identifyin % - total should be equal to 100%)?
% (specify 0-5-10-15-25-50-100)Fundamental researchInnovation activitiesUsing research & innovation results to bringproducts and services to the marketDevelopment of national/regional cluster (ornational/regional centres of excellence)Start-up supportSME supportPublic Procurement of innovation orpre-commercial support of development andinnovation
No opinion
Individual, large-scale "Flagship" initiativesCoordination of European innovation andresearch activitiesDefinition of common requirements forcybersecurity products and services forspecific application domains at European level(e.g. transport, energy…)Other (please specify)TOTAL (100%)
20
3. In which areas would a prioritisation of European support actions be most effective? (Pleaseidentify your 3-5 top priorities)
*3.1. In terms of research priorities following the terminology of the of theStrategic Research AgendaNIS Platform [1]
between 2 and 3 choicesIndividuals' Digital Rights and Capabilities (individual layer)Resilient Digital Civilisation (collective layer)Trustworthy (Hyperconnected) Infrastructures (infrastructure layer)Other
*3.2. In terms of products and servicesbetween 3 and 5 choices
Identity and access managementData securityApplications securityInfrastructure (network) securityHardware (device) securityIT security audit, planning and advisory servicesIT security management and operation servicesIT security trainingOther
Please explain:
600 character(s) maximum
4. In which sectors would a prioritisation of European support actions be most effective? (Pleaseidentify top 3 to 5 and explain)between 3 and 5 choices
Critical infrastructure in generalEnergyTransportHealthFinance and BankingDigital Service ProvidersInternet of ThingsCloud ComputingPublic AdministrationOther
Please explain your choice:
1200 character(s) maximum
*
*
21
5. In your opinion which bodies merit particular attention? (Please explain for each category youselect)
Universities and Research InstitutesSMEsStart-upsEnterprises with large market share in nation markets ("National Champions")Enterprises with strong positions on global markets ("Global players")Other
Please explain:
1200 character(s) maximum
No opinion
6. What are the specific needs of innovative SMEs in cybersecurity to stimulate competitiveness?What specific type of public support would be most useful to such companies?
1200 character(s) maximum
No opinion
*7. What would be your contribution to fostering innovation and competitiveness of cybersecurity inEurope?
Support in alignment of national and European research agendasSupport for SMEsCo-funding of national or European activitiesProviding infrastructures for experimenting and testingSupport with expertise in standardisation bodiesContribute to certification schemesOther
Please explain
1200 character(s) maximum
Contributing to secure identification management by developing the Global LEI
System.
VII. The NIS Platform
This section is a separate part of the consultation, not related to the cPPP and accompanyingmeasures, but looking for interested stakeholders' views on the public-private network andinformation security Platform (NISP).
The NIS Platform, which was one of the actions under the EU Cybersecurity Strategy, was
*
22
The NIS Platform, which was one of the actions under the EU Cybersecurity Strategy, wasestablished in June 2013. Its aim was to identify good cybersecurity practices that organisations canimplement in order to increase their resilience. These practices were expected to facilitate the futureimplementation of the NIS Directive, but are also relevant to a wide range of organisations notcovered by the Directive.
The Platform gathered almost 600 stakeholders representing the business community, civil society,academia, researchers and member states. NIS Platform work has been divided into threesub-groups dealing with risk management; voluntary information exchange and incident coordinationas well as secure ICT research and innovation. Over the course of two years the working groupshave developed a number of deliverables, including the Strategic Research Agenda, which feeds intothe process of creating the contractual Private Public Partnership on cybersecurity addressed in theprevious sections of this consultation.
The Commission would like to take the opportunity to ask stakeholders, who participated in the effortsof the NIS Platform, about their views on Platform's work to date. The Commission would also like tohave the views of all interested stakeholders on the future of the NIS Platform. It will take these viewsinto consideration in the process of developing a new Work Programme for the NIS Platform followingthe expected adoption of the NIS Directive in early 2016.
1. NIS Platform format - what did you like about the structure and working methods of the NIS Platformand what would you suggest changing (if anything)?
1200 character(s) maximum Question for stakeholders who took part in the NIS Platform's work
No opinion
2. What possible future areas of work should the NIS Platform focus on following the adoption of theNIS Directive?
1200 character(s) maximum Question for all stakeholders
No opinion
3. What were your reasons for engaging/not engaging in the NIS Platform's work so far?
1200 character(s) maximum Question for all stakeholders
GLEIF was not aware of the NIS platform until this questionnaire.
4. What would be your motivation for engaging in the NIS Platform's work after the adoption of the NISDirective, and what expectations would you have?
1200 character(s) maximum Question for all stakeholders
As previously stated, GLEIF is relying on its providers for cyber security.
23
VIII. Sharing your data and views
*Please upload additional data and information relevant to this survey.
2000 character(s) maximum
Not applicable
Please upload your file
[1] For further information, please consult the Strategic Research Agenda of the WG3 Network andInformation Security (NIS) Platform -https://resilience.enisa.europa.eu/nis-platform/shared-documents/wg3-documents/strategic-research-agenda-draft-v02.63/view
Contact [email protected]
*